Matching on the hostname is a very fragile way of doing this...  Can we not follow a the pattern we've used in content_api where it always authenticates when given a bearer token, and the public path to the app strips any Auth headers so that it's not possible to DOS the signon server etc.